angr.go.knowledge_plugins.go_signatures¶

angr.go.knowledge_plugins.go_signatures.placeholder_group(words)¶

The spelling of words result words read together that nobody typed: a struct, so that it still travels in result registers (an array would go through memory under ABIInternal).

Return type:: str
Parameters:: words (int)

angr.go.knowledge_plugins.go_signatures.is_placeholder_type(type_str)¶

uintptr or a word group nobody typed (struct { W0 uintptr; W1 uintptr }, []uintptr).

Return type:: bool
Parameters:: type_str (str)

class angr.go.knowledge_plugins.go_signatures.GoInferredSignature¶

Bases: dict

What the decompiler inferred about a function nobody names: parameter types from the callees its parameters reach, and result types from its own return statements (results, word -> (type, words spanned)) and from how callers use the result registers (caller_results). groups (word -> (words spanned, type or None)) are caller-side groupings of result words read as one value, typed when the shape of the reads says what they are (an interface pair), else kept together as a placeholder. Word indices count ABIInternal integer result registers; fp_results (index -> type) counts the floating-point ones, which Go assigns independently. A plain dict underneath so records survive JSON and pickling between the processes of a sweep.

property params: list[str] | None¶

property results: dict[int, tuple[str, int]]¶

property caller_results: dict[int, tuple[str, int]]¶

property groups: dict[int, tuple[int, str | None]]¶

property result_words: int¶: How many result registers callers read after a call, typed or not.

property return_words: int¶

unknown).

Type:: How many result registers the function’s returns write, where that is fewer than the guess (0

property fp_results: dict[int, str]¶

property has_int_results: bool¶

property has_results: bool¶

merge(params=None, results=None, caller_results=None, result_words=0, groups=None, return_words=0, fp_results=None)¶

Parameter types replace the earlier ones; result types accumulate (over callers, and over passes as callees get typed), the first to type a word wins unless a later one types a wider value there. A typed group replaces an untyped one of the same span. The smallest return_words wins. Returns whether the record changed.

Return type:

bool

Parameters:

result_words (int)
return_words (int)

fp_result_types(floor)¶

The floating-point results, after the integer ones; floor is how many the guessed prototype has.

Return type:: list[str]
Parameters:: floor (int)

result_types(floor)¶

The result list: callee-side types win, caller-side types fill the gaps, then caller-side groups (an untyped group is spelled by placeholder_group), words nobody typed stay uintptr. floor is the number of words the guessed prototype already returns, less any its own returns showed it never writes.

Return type:: list[str]
Parameters:: floor (int)

angr.go.knowledge_plugins.go_signatures.available_signature_dbs()¶

Installed stdlib signature databases, keyed by minor version (go1.22).

Return type:: dict[str, Path]

angr.go.knowledge_plugins.go_signatures.load_signature_db(go_version)¶

The stdlib signature database for go_version, falling back to the closest installed minor version.

Return type:: GoSignatureSet | None
Parameters:: go_version (str | None)

class angr.go.knowledge_plugins.go_signatures.GoSignatures¶

Bases: KnowledgeBasePlugin

Go function signatures and named types known for this binary, merged from every source (external tools, DWARF, the binary’s runtime type descriptors, the stdlib database, in that priority) and turned into Go SimTypes on demand.

__init__(kb)¶

record_version(key)¶

The counter value when the record key (a function name, callsite:0x.. or closure:0x..) last changed; 0 when it was never written.

Return type:: int
Parameters:: key (str)

record_fingerprint(key)¶

A process-independent spelling of the record key as it is now (None when absent), for comparing what a decompilation consulted with what another process knows.

Return type:: str | None
Parameters:: key (str)

track()¶

Record which inference records are consulted while the block runs, each with the version it had when first consulted (deps). Nested scopes report to the enclosing one.

Return type:: Iterator[dict[str, int]]

untracked()¶

Suspend dependency tracking: for one-off whole-binary scans that are nobody’s dependency.

Return type:: Iterator[None]

note(name)¶

Count the inferred record of name as consulted by the decompilation in progress.

Return type:: None
Parameters:: name (str)

deps_current(deps, version)¶

Whether a decompilation that started from version and consulted deps (key -> version seen) reflects the current records: none of them changed since. Without a dependency list only the global counter decides.

Return type:

bool

Parameters:

deps (dict[str, int] | None)
version (int | None)

is_current(cache)¶

Whether the decompilation in cache (a DecompilationCache) reflects the current inference records.

Return type:: bool

stale_decompilations(kb=None)¶

The (addr, flavor) keys of the Go decompilations in kb.decompilations that are out of date.

Return type:: list[tuple[int, str]]

add_source(sigs, priority=None)¶

Return type:

None

Parameters:

sigs (GoSignatureSet)
priority (int | None)

load_sources(go_version=None)¶

Load the binary’s own DWARF signatures (when present), its runtime type descriptors and the stdlib database for its Go version. Runs once.

Return type:: bool
Parameters:: go_version (str | None)

load_stdlib(go_version=None)¶

Load the binary’s own DWARF signatures (when present), its runtime type descriptors and the stdlib database for its Go version. Runs once.

Return type:: bool
Parameters:: go_version (str | None)

signature(name)¶

Return type:: GoFuncSignature | None
Parameters:: name (str)

variable_at(addr)¶

Return type:: GoVariable | None
Parameters:: addr (int)

named_type(name)¶

Return type:: GoNamedType | None
Parameters:: name (str)

type_name_at(addr)¶

The name of the type whose runtime descriptor is at addr, when a source (DWARF) recorded it.

Return type:: str | None
Parameters:: addr (int)

property parser: GoTypeParser¶

type(type_str)¶

Return type:: SimType
Parameters:: type_str (str)

prototype(name)¶

The function type of name (receiver first), or None when the signature is unknown.

Return type:: GoSimTypeFunction | None
Parameters:: name (str)

set_inferred(name, param_types=None, results=None, caller_results=None, result_words=0, groups=None, return_words=0, fp_results=None)¶

Record what was inferred for name (kept until a real signature appears): parameter types, callee-side result types, caller-side result types and word groups, how many result registers its returns write, or a whole record (as inferred_record returns it, possibly after a round trip through JSON) in place of the parameter types.

Return type:

GoInferredSignature

Parameters:

name (str)
param_types (list[str] | dict | None)
results (dict[int, tuple[str, int]] | None)
caller_results (dict[int, tuple[str, int]] | None)
result_words (int)
groups (dict[int, tuple[int, str | None]] | None)
return_words (int)
fp_results (dict[int, str] | None)

set_callsite_inferred(addr, caller_results=None, result_words=0, groups=None, fp_results=None)¶

Record what the caller’s reads say about the results of the indirect call at addr (an interface method or closure without a known signature); the next decompilation types the call-site prototype from it.

Return type:

GoInferredSignature

Parameters:

addr (int)
caller_results (dict[int, tuple[str, int]] | None)
result_words (int)
groups (dict[int, tuple[int, str | None]] | None)
fp_results (dict[int, str] | None)

callsite_record(addr)¶

Return type:: GoInferredSignature | None
Parameters:: addr (int)

inferred(name)¶

The inferred parameter types of name.

Return type:: list[str] | None
Parameters:: name (str)

inferred_record(name)¶

Return type:: GoInferredSignature | None
Parameters:: name (str)

results_guessed(func)¶

True when nothing but the calling-convention guess describes the results of func: its prototype is guessed, or it was rebuilt (a promoted receiver, inferred parameters) around the guessed result type.

Return type:: bool
Parameters:: func (Function)

fp_results_open(func)¶

True when callers may still add floating-point results to func: no real signature and no user prototype describe it. Its integer results may already be typed (inferred), which says nothing about the float ones.

Return type:: bool
Parameters:: func (Function)

untyped_params(func)¶

Indices of the parameters of func that only the calling-convention guess describes: a prototype rebuilt around a promoted receiver or inferred results keeps the guessed words (non-Go types, or the uintptr an inferred record spells for words it could not type). Type inference may know better about those, so they are no ground truth. Parameters of a real signature always are.

Return type:: frozenset[int]
Parameters:: func (Function)

inferred_prototype(name, guessed)¶

The inferred signature of name as a function type: inferred parameter types (else the guessed ones) and inferred result types (else the guessed result type guessed.returnty).

Return type:: GoSimTypeFunction | None
Parameters:: name (str)

set_closure_context(addr, type_str)¶

Record the closure record type a parent function builds for the closure body at addr.

Return type:

None

Parameters:

addr (int)
type_str (str)

closure_context(addr)¶

The closure record type of the body at addr (captures are its fields after F), if known.

Return type:: str | None
Parameters:: addr (int)

arg_size_at(addr)¶

The byte size of the parameters of the function at addr from the pclntab (results excluded).

Return type:: int | None
Parameters:: addr (int)

prototype_at(addr)¶

The function type of the method whose code starts at addr, from the runtime type descriptors’ method tables (receiver first). Covers methods of named types in stripped binaries, which no signature source names.

Return type:: GoSimTypeFunction | None
Parameters:: addr (int)

copy()¶